Security audit
Security checks for vulnerabilities and agentic risk
This cloud-training skill needs review because its verification steps can submit paid training jobs and delete test tasks without clear approval.
Select the intended workspace explicitly and use credentials limited to the required resources. Require clear approval before verification starts compute or deletes tasks; avoid running the bundled test script unchanged. Set compute limits and review the external CLI package separately, since its implementation was not included. The scanner's SDK coverage gap was manually investigated; no cloud operations were executed.
The supplied command targets the asset publication catalog, not training or SimRL task resources. Algorithm-asset discovery is not declared, and the chunk provides no task-related context establishing it as a supporting implementation detail.
Listing checkpoints is reasonably related to training-task monitoring. However, registering a checkpoint as a new model or model version introduces a model-registration capability not disclosed in the description. Saving draft task configurations does not cover creating model-registry artifacts. The absence of other declared operations from this limited chunk is not itself a mismatch.
Referenced artifact was not completely inspected
> [SDK Quick Start](references/sdk-quickstart.md).
Referenced artifact was not completely inspected
- [SDK Quick Start](references/sdk-quickstart.md) — Complete Python SDK call templates: initialization, finetune/pretrain/SimRL full request body examples, draf
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
| List tasks | `list-tasks [--train-mode] [--status] [--offset] [--limit]` | `list_train_tasks` / `list_sim_rl_tasks` | `GET /` |
| Show task | `show-task --task-id <id>` | `show_train_task` / `show_sim_rl_task` | `GET /{task_id}` |
| Update task | `update-task --task-id <id> --config '<json>'` | `update_train_task` / `update_sim_rl_task` | `PATCH /{task_id}` |
| Delete tasks | `delete-tasks --task-id <id> [--task-id <id>...]` | `batch_delete_train_tasks(execution_ids)` / `delete_sim_rl_task(task_id)` | `POST /batch-delete` (train) / `DELETE /{task_id}` (SimRL) |
> **delete-tasks behavior**: For regular training tasks, the CLI auto-resolves `execution_id` from
> the provided `task_id` via `show-task` before calling batch-delete. Users can pass task IDs
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
| Save draft (train / SimRL) | Write access to `cloudrobo-service` (`/v1/training/train-tasks/draft`, `/v1/training/rl-tasks/simulation/draft`) |
| Update task name/description | Write access to `cloudrobo-service` (`PATCH /v1/training/train-tasks/{id}`, `PATCH /v1/training/rl-tasks/simulation/{id}`) |
| Batch delete train-tasks | Delete access to `cloudrobo-service` (`POST /v1/training/train-tasks/batch-delete`) |
| Delete SimRL task | Delete access to `cloudrobo-service` (`DELETE /v1/training/rl-tasks/simulation/{id}`) |
| View stages / resource-usage / events / logs / signed-url | Read access to task sub-resources |
| Count tasks by status | Read access to `cloudrobo-service` (`/v1/training/train-tasks/stats`, `/v1/training/rl-tasks/simulation/stats`) |
| Checkpoint management (list/register) | Read/Write access to `cloudrobo-service` (`/v1/training/train-tasks/{id}/checkpoints`) |
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
| create_sim_rl_task_draft | `create_sim_rl_task_draft(req)` | `save-draft --sim-rl` | `POST /v1/training/rl-tasks/simulation/draft` |
| show_sim_rl_task | `show_sim_rl_task(task_id)` | `show-task --sim-rl` | `GET /v1/training/rl-tasks/simulation/{task_id}` |
| update_sim_rl_task | `update_sim_rl_task(task_id, req)` | `update-task --sim-rl` | `PATCH /v1/training/rl-tasks/simulation/{task_id}` |
| delete_sim_rl_task | `delete_sim_rl_task(task_id)` | `delete-tasks --sim-rl` | `DELETE /v1/training/rl-tasks/simulation/{task_id}` |
| stop_sim_rl_task | `stop_sim_rl_task(task_id)` | `stop-task --sim-rl` | `POST /v1/training/rl-tasks/simulation/{task_id}/stop` |
| copy_sim_rl_task | `copy_sim_rl_task(task_id, req=None, task_detail=None)` | `clone-task` | `POST /v1/training/rl-tasks/simulation/{task_id}/copy` |
| restart_sim_rl_task | `restart_sim_rl_task(task_id, req=None, workspace_id=None, task_detail=None)` | `restart-task --sim-rl` | `POST /v1/training/rl-tasks/simulation/{task_id}/restar
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
and `algorithm_version_id` (2-field format). The backend auto-resolves engine/command from the
algorithm asset. Top-level `inputs`/`outputs` arrays are required. See [Workspace Model Sub-flow](#step-3a-ws--workspace-model-sub-flow) below.
2. **Select model** → extract `asset_id` + `latest_version_id` from the selected model's list entry.
**Do NOT ask user for version again** — auto-use `latest_version_id`. Only ask if user explicitly
wants a non-latest version.
3. **Query model version detail** `GET /v1/assets/{asset_id}/versions/{version_id}` → get `actions`
array. Each action: `{action, algorithm:{asset_id, version_id}, status}`
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Steps 6-13 (ext_metadata, hyperparams, dataset, resource, output model, submit, poll) are shared.
1. **Select workspace model** → extract `asset_id` + `latest_version_id` from the list entry.
**Do NOT ask user for version again.**
> **Critical**: Workspace model must have `status == "DRAFT"`. Models in `CREATING`
> status cannot be used as input and will cause `CREATE_FAILED` with error `"输入模型未就绪"`.
> If no DRAFT models exist in the workspace, inform the user and suggest using a Gallery model instead.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
--action-status ENABLE --actions LIBERO_SPATIAL,LIBERO_OBJECT,LIBERO_GOAL,LIBERO_10
--actions-operator OR` → pick model →
extract `model_asset_id` + `latest_version_id`. `source_type: "PUBLIC_MODEL_ASSET"`.
**Do NOT ask user for version again** — auto-use `latest_version_id`.
**Critical**: The `--actions` and `--action-status` filters are REQUIRED — without them, the query
returns ALL Gallery models, not just SimRL-compatible ones. Only models with ENABLED LIBERO_*
actions can be used for SimRL tasks.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
non-training actions like "ONLINE_DEPLOYMENT". The `action` field value becomes the
`train_method` in the request body. Do NOT offer actions the model does not advertise.
5. **User picks method** → extract matched action's `action` value (this is `train_method`) and
`algorithm.asset_id` + `algorithm.version_id`. **Do NOT ask user for algorithm version** —
it comes directly from the action. Auto-extract and proceed.
6. **Query algorithm version detail** `GET /v1/assets/{algo_asset_id}/versions/{algo_version_id}` →
get `ext_metadata`. Extract from exact fields:
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
## Edge Cases
| Scenario | Handling |
| ---------- |----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Missing `workspace_id` | All commands auto-resolve from config or auto-query; run `cloudrobo workspace use` to set default |
| Task in non-terminal state | Poll at 30-60s intervals; training can run for hours/days
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
|
| ---------- |----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Missing `workspace_id` | All commands auto-resolve from config or auto-query; run `cloudrobo workspace use` to set default |
| Task in non-terminal state | Poll at 30-60s intervals; training can run for hours/days |
| `spec` format | String `Ascend: <n> * <model> \| <vCPUs> vCPUs
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
|
| Object storage | Must use `obs://` protocol; `s3://` prohibited |
| Cross-skill | Does not call other skills; data processing → `cloudrobo-dataset`, deployment → `cloudrobo-infer` |
| `--sim-rl` flag | On 15 commands; absent on `resume-task`/`list-checkpoints`/`register-checkpoint` (train-only); `clone-task` is inherently SimRL-only |
| `get-logs` file selection | `--file-name` (not `--file-path`); `--log-name-pre` matches by prefix
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
------------------------------------------------------------------------------------------------------------------------------------|
| Missing `workspace_id` | All commands auto-resolve from config or auto-query; run `cloudrobo workspace use` to set default |
| Task in non-terminal state | Poll at 30-60s intervals; training can run for hours/days |
| `spec` format | String `Ascend: <n> * <model> \| <vCPUs> vCPUs \| <GiB> GiB`, not JSON. Filter by `ext_metadata.resource` constraints |
| `train_method` / `train_mode` | Upp
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
|
| Task in non-terminal state | Poll at 30-60s intervals; training can run for hours/days |
| `spec` format | String `Ascend: <n> * <model> \| <vCPUs> vCPUs \| <GiB> GiB`, not JSON. Filter by `ext_metadata.resource` constraints |
| `train_method` / `train_mode` | Uppercase enums: `FFT`/`SFT`/`LORA`/`QLORA`/`DEEPSPEED`; `MODEL_TUNING`/`TRAIN_FROM_SCRATCH` |
| CREATE_FAILED | Check `spec` format, `cluster_id`, resource availability, task
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
|
| `spec` format | String `Ascend: <n> * <model> \| <vCPUs> vCPUs \| <GiB> GiB`, not JSON. Filter by `ext_metadata.resource` constraints |
| `train_method` / `train_mode` | Uppercase enums: `FFT`/`SFT`/`LORA`/`QLORA`/`DEEPSPEED`; `MODEL_TUNING`/`TRAIN_FROM_SCRATCH` |
| CREATE_FAILED | Check `spec` format, `cluster_id`, resource availability, task name uniqueness (409 Conflict), **input model status** (must be `DRAFT` for workspace models) |
| RUN_FAILED | Check logs/events; common: OOM, image pull failure, datas
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
rkspace models) |
| RUN_FAILED | Check logs/events; common: OOM, image pull failure, dataset access denied, **dataset format incompatibility** (exitCode 1 in <2 min, no logs) |
| Resource scheduling failure | Check `spec`, `worker_num`, cluster capacity, and `ext_metadata.resource` min NPU constraint |
| Stopped task | Use `restart-task` to resubmit; `resume-task` for supported train-only cases |
| SimRL resume | Not supported; `--sim-rl` not accepted on `resume-task`
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
|
| `train_method` / `train_mode` | Uppercase enums: `FFT`/`SFT`/`LORA`/`QLORA`/`DEEPSPEED`; `MODEL_TUNING`/`TRAIN_FROM_SCRATCH` |
| CREATE_FAILED | Check `spec` format, `cluster_id`, resource availability, task name uniqueness (409 Conflict), **input model status** (must be `DRAFT` for workspace models) |
| RUN_FAILED | Check logs/events; common: OOM, image pull failure, dataset access denied, **dataset format incompatibility** (exitCode 1 in <2 min, no logs) |
| Resource scheduling failure | Check `spec`, `worker_num`, cluster capacity, and `ext_metadata.resource` min NPU constraint
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
|
| CREATE_FAILED | Check `spec` format, `cluster_id`, resource availability, task name uniqueness (409 Conflict), **input model status** (must be `DRAFT` for workspace models) |
| RUN_FAILED | Check logs/events; common: OOM, image pull failure, dataset access denied, **dataset format incompatibility** (exitCode 1 in <2 min, no logs) |
| Resource scheduling failure | Check `spec`, `worker_num`, cluster capacity, and `ext_metadata.resource` min NPU constraint |
| Stopped task | Use `restart-task` to resubmit; `resume-task` for supported train-only cases
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
`detail_status` 17 values: CREATING/RUNNING/FAILED/WAITING/DRAFT/FINISHED/STOPPING/DELETING/ABNORMAL/RUN_FAILED/CREATE_FAILED/STOP_FAILED/STOPPED/DELETED/DELETE_FAILED/NOT_EXIST/UNKNOWN (align with task-config-catalog); terminal status: FINISHED/FAILED/RUN_FAILED/CREATE_FAILED/STOPPED/STOP_FAILED/DELETED/DELETE_FAILED/NOT_EXIST/ABNORMAL |
| Task deletion | Irreversible. CLI `delete-tasks --task-id <id>` auto-resolves `execution_id` from task_id for regular training tasks; no manual lookup needed |
| Algorithm info | Dynamically fetched from `ext_metadata`; do not hardcode asset_ids |
| Object storage | Must use `obs://` protocol; `s3://` prohibited
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
min, no logs) |
| Resource scheduling failure | Check `spec`, `worker_num`, cluster capacity, and `ext_metadata.resource` min NPU constraint |
| Stopped task | Use `restart-task` to resubmit; `resume-task` for supported train-only cases |
| SimRL resume | Not supported; `--sim-rl` not accepted on `resume-task` |
| Draft submit via CLI | `restart-task` supports `--confi
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
t |
| Stopped task | Use `restart-task` to resubmit; `resume-task` for supported train-only cases |
| SimRL resume | Not supported; `--sim-rl` not accepted on `resume-task` |
| Draft submit via CLI | `restart-task` supports `--config`/`--config-file` to edit fields before resubmit |
| Missing required fields |
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
|
| SimRL resume | Not supported; `--sim-rl` not accepted on `resume-task` |
| Draft submit via CLI | `restart-task` supports `--config`/`--config-file` to edit fields before resubmit |
| Missing required fields | SDK validates before HTTP call; CLI shows `click.UsageError` with the missing field list |
| AK/SK not set | Operations fail at HTTP signing s
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
|
| Draft submit via CLI | `restart-task` supports `--config`/`--config-file` to edit fields before resubmit |
| Missing required fields | SDK validates before HTTP call; CLI shows `click.UsageError` with the missing field list |
| AK/SK not set | Operations fail at HTTP signing step; set `HUAWEI_CLOUD_AK`/`HUAWEI_CLOUD_SK` |
| Array size limits | `datasets`, `input_models`, `output_models` —